Sublime Core Feed

This repo contains open-source Rules for Sublime, a free and open platform for detecting and preventing email attacks like BEC, malware, and credential phishing.

Sublime Security
Last updated May 18th, 2026
Feed Source
Tactic or Technique is
Rule Name & Severity
Author
Last Updated
Labels
Attachment: Fake lawyer & sports agent identities
Sublime Security
3mo ago
Jan 26th, 2026
Google share notification with suspicious comments
Sublime Security
4mo ago
Jan 12th, 2026
Impersonation: Executive using numbered local part
Sublime Security
3mo ago
Jan 30th, 2026
Service Abuse: Box file sharing with credential phishing intent
Sublime Security
4mo ago
Jan 12th, 2026
Service abuse: Trello board invitation with VIP impersonation
Sublime Security
3mo ago
Feb 3rd, 2026
Suspicious attachment with unscannable Cloudflare link
Sublime Security
4mo ago
Jan 12th, 2026
Suspicious request for financial information
Sublime Security
22d ago
Apr 27th, 2026
VIP / Executive impersonation in subject (untrusted)
Sublime Security
9mo ago
Aug 14th, 2025
VIP / Executive impersonation (strict match, untrusted)
Sublime Security
2mo ago
Feb 25th, 2026
VIP impersonation: Fake thread with display name match, email mismatch
Sublime Security
1mo ago
Apr 3rd, 2026
VIP impersonation with BEC language (near match, untrusted sender)
Sublime Security
1mo ago
Mar 25th, 2026
VIP impersonation with charitable donation fraud
Sublime Security
6mo ago
Nov 12th, 2025
VIP impersonation with invoicing request
Sublime Security
2y ago
Apr 23rd, 2024
VIP impersonation with urgent request (strict match, untrusted sender)
Sublime Security
1mo ago
Mar 25th, 2026
VIP impersonation with w2 request with reply-to mismatch
Sublime Security
2mo ago
Mar 12th, 2026
VIP local_part impersonation from unsolicited sender
Sublime Security
9mo ago
Aug 12th, 2025